Splunk Structure

The Splunk infrastructure is made up of various components

Indexer – processes incoming machine data and stores the results in indexes for searching. Raw data is compressed and indexes point to the data

Search Head – takes the search request and distributes it to the indexes which search the data, then consolidates the results and displays them. Knowledge objects on the search head can be used to create additional fields and transform the data

Forwarder – consume data and forwards it to the indexers for processing

Deployment Server - distributes content and configurations

Cluster Master -  coordinates the replicating activities of the peer nodes and tells the search head where to find data

License Master – shares licenses with other nodes

The Folder Structure

The structure of the folders within Splunk is as follows:

Comparison of big data engines

A comparison of big data querying engines is below.

Apache HBase is the Hadoop database, a distributed, scalable, big data store. HBase is an open-source, non-relational, distributed database modelled after Google's Bigtable and is written in Java.

Apache Hive is a data warehouse software project built on top of Apache Hadoop for providing data summarization, query and analysis. Hive gives an SQL-like interface to query data stored in various databases and file systems that integrate with Hadoop.

Splunk turns machine data into answers with the leading platform to tackle the toughest IT, IoT and security challenges.

More details of the comparison HBase vs. Hive vs. Splunk

Introduction to Splunk for operational intelligence

Machine data is everywhere. Machine data is digital information created by computers, mobile phones, embedded systems, sensors and other networked devices. The data types:

Machine data can intersect with and improve human lives. A summary is in this video

Splunk, a software platform, has the capability to leverage machine data for data management and analytics.  It can be used for

• Data driven decision making
• Alerts for network security threats
• Report on system failures
• Analyse and improve functionality

It enables performance analysis, dashboard creation, monitoring, troubleshooting and investigation of the real-time data collected. A Edureka learning video showed the Splunk components.  

and an overview of Splunk.

The very useful Splunk free fundamentals 1 course is a self paced learning course covering search, navigation, use of fields, statistics, reports, dashboards and alerts.